# Fail2Ban
Protects SSH on kaburusvr (49.13.202.144) against brute-force attacks.
## Configuration
Config file: `/etc/fail2ban/jail.local`
| Setting | Value | Notes |
| ——— | ——- | ——- |
| bantime | 86400 (24h) | Incremental — doubles on repeat offenders, max 7 days |
| findtime | 900 (15 min) | Window to count failures in |
| maxretry | 5 | Failures before ban |
| mode | aggressive | Catches more attack patterns |
| banaction | nftables | Set in jail.d/defaults-debian.conf |
## Whitelisted networks
- `127.0.0.1/8` — localhost - `::1` — IPv6 localhost - `100.64.0.0/10` — entire Tailscale CGNAT range (we and Hermes connect via Tailscale — never banned)
## Incremental banning
`bantime.increment = true` means repeat offenders get longer bans: - 1st ban: 24h - 2nd ban: 48h - 3rd ban: 96h - Max: 7 days (604800s)
## Management commands
```bash # Check status fail2ban-client status sshd
# Unban an IP (e.g. if you lock yourself out) fail2ban-client set sshd unbanip 1.2.3.4
# Check current settings fail2ban-client get sshd bantime fail2ban-client get sshd maxretry fail2ban-client get sshd findtime
# View ban log tail -f /var/log/fail2ban.log
# Restart systemctl restart fail2ban ```
## Hermes alerts
Hermes runs periodic security checks and sends Telegram alerts. If you're getting frequent alerts, the likely causes are: - bantime too short — attackers wait out the ban and return (was 10 min, fixed 2026-05-16) - Fail2Ban not triggering — check `fail2ban-client status sshd` for ban count vs failure count - Background noise — internet scanners are constant, this is normal if bans are happening
## Ubuntu caveat — ssh vs sshd unit name
On Ubuntu (kaburuaibox), the SSH service is `ssh.service`, not `sshd.service` (Debian uses `sshd.service`).
If Fail2Ban uses `backend = systemd` (as we do), the default sshd jail filter matches `_SYSTEMD_UNIT=sshd.service`, which doesn't exist on Ubuntu — making the jail blind to all failures.
Fix: Add an override in `/etc/fail2ban/jail.d/ssh-service-override.conf`: ```ini [sshd] journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=ssh ignoreip = 127.0.0.1/8 ::1 192.168.0.0/24 ```
The LAN `192.168.0.0/24` is whitelisted because all valid SSH access to kaburuaibox is internal.
## History
- 2026-05-12: Initial setup with Tailscale whitelist (100.64.0.0/10) - 2026-05-16: Fixed bantime 600→86400, findtime 600→900, added incremental banning, aggressive mode - 2026-07-01: Fixed Ubuntu unit name mismatch on kaburuaibox (sshd.service → ssh.service), added LAN whitelist